Rippling setup - Configview Support

ConfigView reads your Rippling company through Rippling’s REST API, using an API token that a Rippling admin creates. You don’t need a Rippling partner app or the App Shop. You will end up with 1 secret in ConfigView (RIPPLING_API_TOKEN) when setup is complete.

Scope of this integration today. ConfigView reads everyone who works or has worked at the company, with their status, start and end dates, title, department, manager and work email. It also reads Rippling login accounts, Rippling groups and who is in them, the accounts Rippling creates, suspends and deletes in your other apps (Slack, Google Workspace, GitHub and so on), devices managed through Rippling IT, the software Rippling pushes to them, and the Rippling Activity Log. ConfigView only reads. It never changes anything in Rippling. ConfigView never collects pay, bank details, tax ids, Social Security numbers, date of birth, home address, phone numbers, gender, race or ethnicity, even when the token’s scopes would allow it.

Before you start: plan and permissions

API access. Every endpoint ConfigView reads needs Rippling’s API Tier 1 entitlement. If Tools → Developer → API Tokens isn’t in your Rippling account, ask your Rippling account manager to turn on API access.
Activity Log. The Activity Log needs a separate entitlement, Activity Log Platform API. Without it, ConfigView skips the Activity Log and collects everything else. The health check lists which API entitlements your company has.
Devices and software. These only have data if you use Rippling IT device management. Without it, those two tables stay empty.
Who creates the token. A token can only see what its creator can see in Rippling, so it should be created by a Full Admin: someone whose permission profile covers all employees, apps and devices and who is also an Activity Log admin. A narrower admin’s token returns fewer people, and fields they can’t see come back blank.

Step 1: Open the Rippling page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/rippling Rippling shows the token once, when you create it, so paste it straight into ConfigView instead of keeping it in a notes file.

Step 2: Create an API token in Rippling

Sign in to Rippling as the admin who will own the token (see above)
Go to Tools → Developer → API Tokens (app.rippling.com/api-tokens). You can also search for “API Tokens”
Click Create API token. Name it ConfigView and keep the newest API version
Under scopes, select only these read scopes:

Scope	What ConfigView reads with it
`companies.read`	Your company’s name, to confirm the token works
`workers.read`	Employees and leavers: status, start and end dates, title, manager, work email
`users.read`	Rippling login accounts and names
`departments.read`	Department names
`teams.read`	Team names
`supergroups.read`	Rippling groups and their members
`app-users.read`	Accounts Rippling manages in your other apps
`devices.read`	Rippling IT devices (skip it if you don’t use Rippling IT)
`software-deployments.read`	Software Rippling IT pushes to devices (skip it if you don’t use Rippling IT)
`activity-log.read`	The Activity Log
`activity-log.sensitive-data.read`	Optional. Adds the IP address and city/country to Activity Log sign-ins. Without it, the “sign-ins from a new country” question has nothing to compare

Don’t add any .read-write scope, or any payroll, compensation, time, leave or recruiting scope. ConfigView doesn’t use them.

Create the token and copy it. It’s shown once
Switch to the ConfigView tab, paste it into RIPPLING_API_TOKEN under Credentials, and click the save icon

Rippling emails the token owner, API Token admins and Super/Full Admins whenever a token is created. That’s expected.

Keeping the token alive

Rippling revokes a token that hasn’t been used for 30 days. ConfigView’s daily collection keeps it in use. If you pause every Rippling collector for a month, the token stops working and you’ll need a new one.
Rippling revokes a token when its owner is terminated, and you can’t transfer ownership. If the admin who created it leaves, create a new token from another admin and paste it in. The health check reports a revoked token as a 401.
Only the token’s owner can change its scopes.

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/rippling, confirm the credential shows as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Company	The Rippling company the token belongs to: its name, legal name and trading name, and how many legal entities it has.
Workers	Everyone who works or has worked at the company: employment status, start and end dates, title, department, manager and work email. No pay, date of birth, address or government id.
User Accounts	Rippling login accounts: username, work email, and whether the account can still sign in.
Departments	Departments and the department each one sits under.
Teams	Teams defined in Rippling and the team each one belongs to.
Groups	Rippling groups used to decide who gets which app, policy and permission.
Group Members	Who is in each visible Rippling group. Runs after Groups.
App Accounts	Every account Rippling has created, matched, suspended or deleted in a connected app, with its provisioning state.
Devices	Laptops, desktops, phones and tablets managed by Rippling IT: serial, model, OS, owner, MDM enrollment, disk encryption and last check-in.
Software Deployments	Software Rippling IT pushes to company devices and who it targets.
Activity Log	Sign-ins, admin changes, app provisioning and device actions, with who did it, what it touched, the outcome, and the IP and country.

Click Verify now. The health check confirms the token, names the company, reads one worker, and then tries each other kind of data. Data your plan or the token’s scopes don’t cover is marked skipped, not failed. It also lists which API entitlements your company has and any fields Rippling is hiding from this token.

If a check fails:

Auth fails with 401. The token is wrong or Rippling has revoked it (the owner left, or it went unused for 30 days). Create a new one.
A check is skipped with 403. The token doesn’t have that scope, or its owner’s permission profile doesn’t cover that data. The owner can add the scope under ⋮ → Edit on the token.
Activity Log is skipped with 403. Your company doesn’t have the Activity Log Platform API entitlement, or the token’s owner isn’t a Full Admin or Activity Log admin.

Data Tables

Once the scripts run, these tables are created in your database. Each includes a run_at column. Every table except the Activity Log keeps only the newest run. raw_json holds the record as Rippling returned it, without expanded people records. For workers and user accounts it’s always empty, because Rippling puts personal data in those records.

Table	Source	Key Columns
`rippling_companies`	`GET /companies/`	company_id, name, legal_name, doing_business_as_name, parent_legal_entity_id, legal_entity_count
`rippling_workers`	`GET /workers/?expand=user,department`	worker_id, user_id, full_name, work_email, username, user_active, status, title, is_manager, manager_id, department_id, department_name, team_ids, employment_type_id, legal_entity_id, country, location_type, work_location_id, start_date, end_date, original_start_date
`rippling_users`	`GET /users/`	user_id, display_name, full_name, username, work_email, active, timezone, locale
`rippling_departments`	`GET /departments/`	department_id, name, parent_id, reference_code, hierarchy_ids
`rippling_teams`	`GET /teams/`	team_id, name, parent_id
`rippling_supergroups`	`GET /supergroups/`	group_id, name, display_name, description, group_type, sub_group_type, app_owner_id, parent_id, read_only, is_invisible, include_terminated, allow_non_employees, can_override_role_states, priority
`rippling_supergroup_members`	`GET /supergroups/{id}/members/`	group_id, group_name, member_id, worker_id, full_name, work_email
`rippling_app_users`	`GET /app-users/`	app_user_id, app_handle, app_display_name, worker_id, spoke_user_identifier, external_email, external_username, match_state, push_state
`rippling_devices`	`GET /devices/`	device_id, worker_id, serial_number, model, platform, os_name, os_version, enrollment_status, lifecycle_state, mdm_provider, is_managed, is_encrypted, last_checkin_at, last_mdm_sync_at, pending_action_count
`rippling_software_deployments`	`GET /software-deployments/?expand=software`	deployment_id, software_id, software_name, software_display_name, software_category, software_scope, available_platforms, target_type, group_id, device_group_id
`rippling_activity_log`	`GET /activity-log/`	event_id, occurred_at, recorded_at, event_type, outcome, actor_type, actor_worker_id, source_app_handle, target_types, target_ids, target_worker_ids, reason_code, reason_message, ip_address, city, region, country, device, browser, operating_system

Things worth knowing

The Activity Log is kept beyond Rippling’s 90 days. Rippling keeps 90 days of Activity Log. ConfigView reads it from where the last run stopped and never deletes rows, so your history keeps growing from the day you connect. The first run backfills the 90 days Rippling still has. Workers and user accounts are different things. A worker is the employment record (status, dates, manager). A user is the Rippling login behind it. A leaver’s worker shows TERMINATED, and their user account should show active = 0. When it doesn’t, they can still sign in to Rippling. push_state says what Rippling did in each app. CREATE_CONFIRMED means the account exists. SUSPEND_CONFIRMED and DELETE_CONFIRMED mean Rippling removed access. Anything ending in _FAILED means Rippling tried and the app refused. That’s how a leaver keeps access without anyone noticing. match_state = NOT_MATCHED is an account Rippling found in the app but can’t tie to a person, so it will never offboard it. Admin roles aren’t available. Rippling’s API doesn’t expose permission profiles or who is an admin, so ConfigView can’t list Rippling admins. Rippling groups are collected with their type, and Activity Log events record admin actions. Rippling shows up in Okta too. If Rippling provisions into Okta, Okta’s System Log already records Rippling as the actor on user creates and deactivations. The Rippling integration shows the same flow from Rippling’s side, for every app it provisions, not just Okta. Blank fields usually mean the token can’t see them. Rippling returns null for fields hidden from the token’s owner. The collector logs those field names on every run, and the health check reports them for workers. Rate limits. Rippling allows 600 requests per 10 seconds per token for each endpoint. ConfigView stays far below that.

What isn’t collected

Compensation, pay, payroll, bank accounts, tax and benefits data
Date of birth, gender, race, ethnicity, citizenship, Social Security / SIN / IRD numbers
Personal email, home address, phone numbers and photos
Termination reason and type
Custom fields, documents, time and leave, recruiting
Exact Activity Log location (latitude and longitude). City and country are kept
API token values of any kind

​Before you start: plan and permissions

​Step 1: Open the Rippling page in ConfigView

​Step 2: Create an API token in Rippling

​Keeping the token alive

​Step 3: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected